---
search:
  tags:
    - Portfolio
    - POST
seo:
  description: >-
    Grants one of the member's users access to this account. Reference for the
    POST /portfolio/accounts/{account_id}/grants endpoint in the REST API.
sidebar:
  label: Grant Account Access
  badge: POST
title: Grant Account Access
type: openapi-operation
---
Grants one of the member's users access to this account.

### Endpoint

- Method and path: `POST /portfolio/accounts/{account_id}/grants`
- Operation ID: `createGrant`
- API reference: [POST /portfolio/accounts/{account_id}/grants](/api-reference/rest/portfolio/create-grant)
- Complete specification: [OpenAPI (YAML)](/openapi.yml)
- Spec location (JSON Pointer): `#/paths/~1portfolio~1accounts~1{account_id}~1grants/post`

#### Authorization

- Accepted credentials: `UDX-Access-Key` header and `UDX-Access-Timestamp` header and `UDX-Access-Signature` header; or Bearer token in `Authorization`
- Details: [Authentication](/reference/authentication)

#### Parameters

```yaml
- $ref: "#/components/parameters/VersionHeader"
- $ref: "#/components/parameters/IdempotencyKeyHeader"
- $ref: "#/components/parameters/GrantAccountId"
```


#### Request body

Required: yes

Content type: `application/json`

Schema:

```yaml
$ref: "#/components/schemas/CreateGrantRequest"
```

Example: Example

```json
{
  "user_id": "1194626289313312742"
}
```


#### Responses

##### `202`

The grant was created.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
UDX-Idempotent-Replayed:
  $ref: "#/components/headers/IdempotentReplayed"
```

Content type: `application/json`

Schema:

```yaml
$ref: "#/components/schemas/GrantResponse"
```

Example: Example

```json
{
  "grant": {
    "id": "5822799328558517173",
    "user_id": "1194626289313312742",
    "status": "pending",
    "created_at": "2026-08-20T09:30:00.000000Z"
  }
}
```

##### `400`

The request doesn't conform to this spec.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Invalid request parameters

```json
{
  "type": "urn:udx:problem:invalid-request-parameters",
  "title": "Bad Request",
  "status": 400,
  "detail": "invalid request parameters",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

Example: Unknown UDX-Version

```json
{
  "type": "urn:udx:problem:unknown-version",
  "title": "Bad Request",
  "status": 400,
  "detail": "unknown UDX-Version \"1999-01-01\"; supported versions: 2026-07-15",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `401`

No valid credential was provided.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Authentication failed

```json
{
  "type": "urn:udx:problem:invalid-authentication-credentials",
  "title": "Unauthorized",
  "status": 401,
  "detail": "invalid authentication credentials",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `403`

The credential lacks the grants:manage scope or is restricted to one account.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Insufficient permissions

```json
{
  "type": "urn:udx:problem:insufficient-permissions",
  "title": "Forbidden",
  "status": 403,
  "detail": "insufficient permissions",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `404`

The account doesn't exist or the caller holds no grant on it.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:account-not-found",
  "title": "Not Found",
  "status": 404,
  "detail": "account not found",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `409`

The user already holds a grant on this account or a request with this idempotency key is still in progress.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Grant already exists

```json
{
  "type": "urn:udx:problem:grant-already-exists",
  "title": "Conflict",
  "status": 409,
  "detail": "grant already exists",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

Example: Idempotency key still in progress

```json
{
  "type": "urn:udx:problem:request-with-header-in-progress",
  "title": "Conflict",
  "status": 409,
  "detail": "a request with this UDX-Idempotency-Key is already in progress",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `422`

This idempotency key belongs to a different request.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:header-used-for-different-request",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "UDX-Idempotency-Key was already used for a different request",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `429`

The member rate limit was exceeded.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
Retry-After:
  $ref: "#/components/headers/RetryAfter"
Cache-Control:
  $ref: "#/components/headers/NoStore"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Example

```json
{
  "type": "urn:udx:problem:member-rate-limit-exceeded",
  "title": "Too Many Requests",
  "status": 429,
  "detail": "this member has temporarily exceeded its request rate",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `500`

Something went wrong on UDX's side.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Internal server error

```json
{
  "type": "urn:udx:problem:internal-error",
  "title": "Internal Server Error",
  "status": 500,
  "detail": "internal error",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```

##### `503`

Request admission is unavailable.

Headers:

```yaml
UDX-Version:
  $ref: "#/components/headers/VersionHeader"
Cache-Control:
  $ref: "#/components/headers/NoStore"
```

Content type: `application/problem+json`

Schema:

```yaml
$ref: "#/components/schemas/ProblemDetails"
```

Example: Admission temporarily unavailable

```json
{
  "type": "urn:udx:problem:request-admission-unavailable",
  "title": "Service Unavailable",
  "status": 503,
  "detail": "request admission is temporarily unavailable",
  "instance": "urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef"
}
```


#### Referenced definitions

The references in the excerpts above resolve to these definitions in the complete specification.

##### `#/components/schemas/CreateGrantRequest`

```yaml
type: object
description: The fields needed to grant a user access to an account.
required:
  - user_id
properties:
  user_id:
    type: string
    minLength: 1
    description: The identifier of the member's user to grant access to.
    example: "6820943174116859281"
```

##### `#/components/headers/VersionHeader`

```yaml
description: API version used for this response.
schema:
  type: string
  maxLength: 10
  description: A dated API version (YYYY-MM-DD).
  example: 2026-07-15
```

##### `#/components/headers/IdempotentReplayed`

```yaml
description: true for a replayed response; omitted otherwise.
schema:
  type: string
  enum:
    - "true"
  description: Always the string true when present.
  example: "true"
```

##### `#/components/schemas/GrantResponse`

```yaml
type: object
description: A single grant.
required:
  - grant
properties:
  grant:
    $ref: "#/components/schemas/Grant"
```

##### `#/components/schemas/Grant`

```yaml
type: object
description: A user's authorization to reach one of the member's accounts.
required:
  - id
  - user_id
  - status
  - created_at
properties:
  id:
    $ref: "#/components/schemas/EntityId"
  user_id:
    type: string
    minLength: 1
    description: The user this grant authorizes.
    example: "6820943174116859281"
  status:
    type: string
    description: Readiness of the granted access.
    enum:
      - pending
      - active
      - failed
  created_at:
    type: string
    format: date-time
    maxLength: 40
    description: When access was granted.
```

##### `#/components/schemas/EntityId`

```yaml
type: string
minLength: 1
description: An exchange-assigned identifier. Treat it as an opaque, stable key with no internal structure.
example: "6820943174116859281"
```

##### `#/components/schemas/ProblemDetails`

```yaml
type: object
description: An RFC 9457 machine-readable error, returned on every non-2xx response. The response's Content-Language header identifies the language used by title and detail, and Vary includes Accept-Language.
required:
  - type
  - title
  - status
properties:
  type:
    type: string
    format: uri-reference
    maxLength: 2048
    description: A stable URN identifying the kind of problem, for example urn:udx:problem:insufficient-permissions. Branch on it rather than on the localized detail. It is an identifier, not a URL to dereference.
  title:
    type: string
    maxLength: 40
    example: Bad Request
    description: A localized, human-readable summary of the error category. Stable for a given status code and resolved language — clients must not use it as a machine-readable discriminator.
  status:
    type: integer
    example: 400
    description: The HTTP status code, repeated from the response itself.
  detail:
    type: string
    maxLength: 500
    example: malformed request body
    description: A localized, human-readable explanation specific to this occurrence. Clients must not parse it for machine-readable information.
  instance:
    type: string
    format: uri-reference
    maxLength: 100
    example: urn:request-id:8f14e45f-ceea-4abc-a743-e89a34d3f6ef
    description: An identifier for this specific occurrence, so it can be correlated with server-side logs if you need to report it.
```

##### `#/components/headers/RetryAfter`

```yaml
description: Whole seconds to wait before retrying.
schema:
  type: integer
  minimum: 1
  description: A positive delay in whole seconds.
  example: 2
```

##### `#/components/headers/NoStore`

```yaml
description: Prevents caching this response.
schema:
  type: string
  enum:
    - no-store
  description: Always the cache directive no-store.
  example: no-store
```

##### `#/components/parameters/VersionHeader`

```yaml
name: UDX-Version
in: header
required: false
description: Dated API version (YYYY-MM-DD).
schema:
  type: string
  minLength: 10
  maxLength: 10
  description: A dated API version (YYYY-MM-DD).
  example: 2026-07-15
```

##### `#/components/parameters/IdempotencyKeyHeader`

```yaml
name: UDX-Idempotency-Key
in: header
required: false
description: Optional client-generated key that makes a mutation safe to retry.
schema:
  type: string
  minLength: 1
  maxLength: 255
  description: A unique, client-generated key identifying this request.
  example: b6f1c2a4-2b7e-4c1a-9c2e-2d1f8a3e4b5c
```

##### `#/components/parameters/GrantAccountId`

```yaml
name: account_id
in: path
required: true
description: The public identifier of the account whose grants are managed.
schema:
  $ref: "#/components/schemas/EntityId"
```